greenlock-store-fs.js/index.js

"use strict";

var os = require("os");
var path = require("path");

// How Storage Works in Greenlock: High-Level Call Stack
//
// nested === skipped if parent succeeds (or has cached result)
//
// tls.SNICallback()                                      // TLS connection with SNI kicks of the request
//
//   greenlock.approveDomains(opts)                       // Greenlokc does some housekeeping, checks for a cert in
//                                                        // an internal cache, and only asks you to approve new
//                                                        // certificate // registration if it doesn't find anything.
//                                                        // In `opts` you'll receive `domain` and a few other things.
//                                                        // You should return { subject: '...', altnames: ['...'] }
//                                                        // Anything returned by approveDomains() will be received
//                                                        // by all plugins at all stages
//
//     greenlock.store.certificates.check()               // Certificate checking happens after approval for several
//                                                        // reasons, including preventing duplicate registrations
//                                                        // but most importantly because you can dynamically swap the
//                                                        // storage plugin right from approveDomains().
//     greenlock.store.certificates.checkKeypair()        // Check for a keypair associated with the domain
//
//     greenlock.store.accounts.check()                   // Optional. If you need it, look at other Greenlock docs
//
//     greenlock.store.accounts.checkKeypair()            // Check storage for registered account key
//       (opts.generateKeypair||RSA.generateKeypair)()    // Generates a new keypair
//       greenlock.core.accounts.register()               // Registers the keypair as an ACME account
//       greenlock.store.accounts.setKeypair()            // Saves the keypair of the registered account
//       greenlock.store.accounts.set()                   // Optional. Saves superfluous ACME account metadata
//
//     greenlock.core.certificates.register()             // Begin certificate registration process & housekeeping
//       (opts.generateKeypair||RSA.generateKeypair)()    // Generates a new certificate keypair
//       greenlock.acme.certificates.register()           // Performs the ACME challenge processes
//       greenlock.store.certificates.setKeypair()        // Saves the keypair for the valid certificate
//       greenlock.store.certificates.set()               // Saves the valid certificate

////////////////////////////////////////////
// Recap of the high-level overview above //
////////////////////////////////////////////
//
//  None of this ever gets called except if there's not a cert already cached.
//  That only happens on service boot, and about every 75 days for each cert's renewal.
//
//  Therefore, none of this needs to be fast, fancy, or clever
//
//  For any type of customization, whatever is set in `approveDomains()` is available everywhere else.

// Either your user calls create with specific options, or greenlock calls it for you with a big options blob
module.exports.create = function(config) {
    // Bear in mind that the only time any of this gets called is on first access after startup, new registration, and
    // renewal - so none of this needs to be particularly fast. It may need to be memory efficient, however - if you have
    // more than 10,000 domains, for example.

    // basic setup
    var store = {
        accounts: require("./accounts.js"),
        certificates: require("./certificates.js")
    };

    // For you store.options should probably start empty and get a minimal set of options copied from `config` above.
    // Example:
    //store.options = {};
    //store.options.databaseUrl = config.databaseUrl;

    // In the case of greenlock-store-fs there's a bunch of legacy stuff that goes on, so we just clobber it all on.
    // Don't be like greenlock-store-fs (see note above).
    store.options = mergeOptions(config);
    store.accounts.options = store.options;
    store.certificates.options = store.options;

    if (!config.basePath && !config.configDir) {
        console.info("Greenlock Store FS Path:", store.options.configDir);
    }

    return store;
};

///////////////////////////////////////////////////////////////////////////////
//                                  Ignore                                   //
///////////////////////////////////////////////////////////////////////////////
//
// Everything below this line is just implementation specific
var defaults = {
    basePath: path.join(os.homedir(), ".config", "greenlock"),

    accountsDir: path.join(":basePath", "accounts", ":directoryUrl"),
    serverDirGet: function(copy) {
        return (copy.directoryUrl || copy.server || "")
            .replace("https://", "")
            .replace(/(\/)$/, "")
            .replace(/\//g, path.sep);
    },
    privkeyPath: path.join(":basePath", ":env", ":subject", "privkey.pem"),
    fullchainPath: path.join(":basePath", ":env", ":subject", "fullchain.pem"),
    certPath: path.join(":basePath", ":env", ":subject", "cert.pem"),
    chainPath: path.join(":basePath", ":env", ":subject", "chain.pem"),
    bundlePath: path.join(":basePath", ":env", ":subject", "bundle.pem")
};
defaults.configDir = defaults.basePath;

function mergeOptions(configs) {
    if (!configs.serverKeyPath) {
        configs.serverKeyPath =
            configs.domainKeyPath ||
            configs.privkeyPath ||
            defaults.privkeyPath;
    }

    Object.keys(defaults).forEach(function(key) {
        if (!configs[key]) {
            configs[key] = defaults[key];
        }
    });

    return configs;
}